[dangrossman]

It's extremely unlikely someone will discover a JavaScript bug that provides access to the interpreter running in other tabs. Regardless, if someone has gained control of your webmail tab, they have control of the whole browser. At that point, there's no need to play around with Square Cash e-mail tricks, the malware author can steal credit and debit cards, bank account numbers and other valuable data directly. That's the "gotcha"; if you've already broken into a bank's vault, you don't go back to the tellers and try to make withdrawals with fake IDs.